CVE-2026-17054

The Espressif ESP-hosted Wi-Fi driver drivers/wifi/esphosted/ parses frames received over SPI from the ESP co-processor in esphostedeventtask. For control frames it took the 16-bit TLV field datalength straight off the wire and passed it to pbistreamfrombufferframe.datavalue, frame.datalength...

CVE-2026-17054

CVE-2026-17054 affects the Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) in Zephyr RTOS . The 16-bit TLV data_length field is read from SPI frames without bounds-checking against the receive buffer, allowing an adjacent, unauthenticated attacker to trigger an out-of-bounds read of ...

CVE-2026-17054 Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassembly

The Espressif ESP-hosted Wi-Fi driver drivers/wifi/esphosted/ parses frames received over SPI from the ESP co-processor in esphostedeventtask. For control frames it took the 16-bit TLV field datalength straight off the wire and passed it to pbistreamfrombufferframe.datavalue, frame.datalength...

CVE-2026-17054 Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassembly

The Espressif ESP-hosted Wi-Fi driver drivers/wifi/esphosted/ parses frames received over SPI from the ESP co-processor in esphostedeventtask. For control frames it took the 16-bit TLV field datalength straight off the wire and passed it to pbistreamfrombufferframe.datavalue, frame.datalength...

CVE-2026-17054: Out-of-bounds Read

The Espressif ESP-hosted Wi-Fi driver drivers/wifi/esphosted/ parses frames received over SPI from the ESP co-processor in esphostedeventtask. For control frames it took the 16-bit TLV field datalength straight off the wire and passed it to pbistreamfrombufferframe.datavalue, frame.datalength...